
from django.utils.deprecation import MiddlewareMixin    # 1.10.x

class HttpResponseCustomHeader(MiddlewareMixin):
    def process_response(self, request, response):
        if not response.has_header("Access-Control-Allow-Credentials"):
            response["Access-Control-Allow-Credentials"] = "true"
        return response
